Fix bug 1053099: write downloadable manifest before validating extracted cartridge